Class: Scanny::Checks::XssLoggerCheck

Inherits:
Check
  • Object
show all
Defined in:
lib/scanny/checks/xss/xss_logger_check.rb

Overview

Check for logger methods that are called with request params or a dynamic string. This allows us to avoid executing dangerous code.

Instance Method Summary collapse

Methods inherited from Check

#compiled_pattern, #issue, #strict?, #visit

Instance Method Details

#check(node) ⇒ Object 



13
14
15
 
# File 'lib/scanny/checks/xss/xss_logger_check.rb', line 13

def check(node)
  issue :low, warning_message, :cwe => [20, 79]
end

#pattern ⇒ Object 



6
7
8
9
10
11
 
# File 'lib/scanny/checks/xss/xss_logger_check.rb', line 6

def pattern
  [
    pattern_logger_with_params,
    pattern_dynamic_string,
  ].join("|")
end